CVE WatchJul 13, 2026

CVE-2026-57698

Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-c

CVSS

6.5

Medium

EPSS

0.3%

p17

KEV

—

Exploit Today

0-100

Published: Jul 13, 2026 · Last modified: Jul 13, 2026 · CWE-288

EPSS · 30d

0.3%EPSS · 30 days0.4%

2026-07-132026-07-21

Technical description

Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.

Official references

patchstack.comhttps://patchstack.com/database/Wordpress/Plugin/woo-abandoned-cart-recovery/vulnerability/wordpress-abandoned-cart-recovery-for-woocommerce-plugin-1-1-12-broken-authentication-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-61425—

16.8%

——5The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.4h CVE-2026-39385—

12.5%

——4Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course.22h CVE-2026-161985.6 MED

45.1%

——14A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go of the component First Run Setup. Performing a manipulation of the argument allowed_cidrs results in authentication bypass using alternate channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used. The patch is named 017601354be38cb027ff3ffb01aed79bd5d12610. Applying a patch is the recommended action to fix this issue.1d CVE-2026-579805.4 MED

13.6%

——4Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.1d CVE-2026-474816.5 MED

17.3%

——5NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.6d CVE-2026-576977.5 HIG

25.1%

——8Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6.8d